Ubuntu USN-8819-3 Updates Azure and AWS Kernels for Three Vulnerabilities
Tech GuruQuick Answer
USN-8819-3 covers specific older cloud kernels: Ubuntu 18.04 Azure, Ubuntu 16.04 AWS-HWE and Ubuntu 14.04 Azure. The 18.04 fix uses Ubuntu Pro; the 16.04 and 14.04 fixes require its Legacy Support add-on. Match both release and kernel flavor before updating, then reboot into the fixed image.
Confirm Scope And Apply The Supported Fix
What to do now: confirm the guest can access its entitled repository and that a supported recovery path exists. The version of an image package differs from its tracking metapackage in this notice; compare each by its own binary name below, not by a source-build string pasted into an install command.
Last verified: October 2, 2026 UTC against Canonical's notice and JSON. No entitlement, guest update or reboot was tested.
Scope And Authority
| Product scope | Linux kernel vulnerabilities on Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial), Ubuntu 14.04 ESM (trusty) |
|---|---|
| Advisory | USN-8819-3 |
| CVEs | CVE-2025-38724, CVE-2026-53131, CVE-2026-53221 |
| Authoritative release date | 2026-09-29 09:19:24.606394 UTC |
| Authority revision date | No separate material revision date is stated by Ubuntu; verified against the first-party notice API. |
| Affected versions | The Ubuntu releases and source packages enumerated in USN-8819-3: Ubuntu 18.04 ESM (bionic), Ubuntu 16.04 ESM (xenial), Ubuntu 14.04 ESM (trusty). |
| Fixed version | Binary packages listed by Canonical; select the matching installed flavor, not every row: bionic: linux-image-4.15.0-1207-azure 4.15.0-1207.222bionic: linux-image-azure-4.15 4.15.0.1207.175bionic: linux-image-azure-lts-18.04 4.15.0.1207.175trusty: linux-image-4.15.0-1207-azure 4.15.0-1207.222~14.04.1trusty: linux-image-azure 4.15.0.1207.222~14.04.1xenial: linux-image-4.15.0-1197-aws 4.15.0-1197.210~16.04.1xenial: linux-image-aws-hwe 4.15.0.1197.210~16.04.1 |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
Canonical lists fixes involving the NFS server, IPv6 and Netfilter. It requires a reboot and warns of an ABI change requiring external modules to be rebuilt/reinstalled. Standard kernel metapackages normally pull matching updates when retained; verify that old guest agents, required drivers and the recovery boot option remain usable before the maintenance reboot.
What To Validate Now
- Match release and entitlement. Separate bionic Azure, xenial AWS-HWE and trusty Azure hosts. Confirm the appropriate Pro or Legacy Support repository and actual installed image/metapackage.
- Prepare the old guest for maintenance. Preserve required application state and verify console/recovery access. Check third-party module build results and avoid simultaneous reboots that remove all service capacity.
- Update and reboot. Apply the matching binary packages through the entitled channel and boot the new image. Service restarts do not satisfy Canonical's reboot requirement.
- Validate the cloud path. Read back running kernel and package versions; check guest networking, volumes and required NFS/IPv6/firewall behavior. Do not disable firewall controls merely to resolve an update regression.
- Record the support boundary. Keep boot/test results and unresolved hosts. Maintain the release-migration plan separately from this targeted patch.
Operational Cautions
Legacy Support is a concrete repository entitlement, not a claim that an old system is broadly current. Keep exact release/flavor pairing and recovery evidence. A rollback to an older kernel can restore service but also restore exposure; retain that exception and its follow-up owner.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
